Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 09:05:23 +08:00
Code Packages Activity Actions
discourse/spec/lib/guardian
History
Exact
Isaac Janzen 7e6c7362c2
 FIX: Whisper access bypass for removed users on single-post endpoints (#42323) 
## Summary

Prevent users removed from whisper-allowed groups from accessing or
modifying their own whisper posts via single-post endpoints. The fix
ensures that post-type visibility requirements are enforced in the
Guardian even for post owners, preventing unauthorized read and write
access to the staff-only whisper stream.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1316

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-04 14:29:58 -05:00
..
bookmark_guardian_spec.rb
flag_guardian_spec.rb
invite_guardian_spec.rb FEATURE: Allow inviting new users directly as admins (#41748) 2026-07-16 14:59:24 -07:00
localization_guardian_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
post_guardian_spec.rb FIX: Whisper access bypass for removed users on single-post endpoints (#42323) 2026-08-04 14:29:58 -05:00
post_revision_guardian_spec.rb SECURITY: Block requests for hidden post revisions through historical version reconstruction (#42269) 2026-08-03 12:27:53 -05:00
staff_action_log_guardian_spec.rb
tag_guardian_spec.rb FIX: Don't auto-remove chat members from logged_in_users group (#40543) 2026-06-03 18:15:32 +02:00
topic_guardian_spec.rb FEATURE: Allow topic_timers_allowed_groups to manage topic timers (#41126) 2026-06-23 12:46:56 -05:00
upload_guardian_spec.rb FIX: Enforce secure-upload ACL in AI bot prompt path (#39903) 2026-05-13 09:55:32 +08:00
user_guardian_spec.rb FIX: Prevent moderators from deleting peer moderators (#42248) 2026-08-04 09:45:57 -03:00